Create LEF From Folders Using Logical and UNC Path

UPDATE In this version (v3.0) the examiner can choose the maximum segment-size for the resultant logical evidence file.

This script is designed to create an EnCase logical evidence file from the contents of one or more folders specified by the user. Folders can be identified by logical or UNC paths. The script will scan the contents of the chosen folders and display a list of their contents. The user can then select the files they would like added to the LEF. Note that files with a non-null logical size will be pre-selected automatically. Note that the user cannot choose folders as individual items: folders will be added automatically if they contain selected files.

This EnScript will search for, and bookmark, ZIP-file index-entries. It was designed for the recovery of data from deleted ZIP files that can't otherwise be recovered, either because they're partially overwritten or fragmented.